CVE-2020-0448 - In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permission check

Back Back to CVE browser

MEDIUM

In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permission check

Published Nov 10, 2020

5.5

MEDIUM

CVSS 3.1

EPSS 0.15%

Description

In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permission check. This could lead to local information disclosure of the identifier, which could be used to track an account across devices, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-153995334

Affected products

Vendor n/a Product Android Default
n/a
- Version
  Android-8.0 Android-8.1 Android-9 Android-10 Android-11
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Android

n/a

Version	Status	Constraints
Android-8.0 Android-8.1 Android-9 Android-10 Android-11	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-1949
Advisory
https://source.android.com/security/bulletin/2020-11-01
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-1949		Advisory
https://source.android.com/security/bulletin/2020-11-01		x_refsource_MISCPatchVendor Advisory